How to read CVSS v3.1
How CVSS v3.1 Works
The Common Vulnerability Scoring System (CVSS) translates complex security bugs into a standardized score from 0.0 to 10.0.
A vector string is structured into three core blocks of Base Metrics:
1. Exploitability Metrics – How hard is it to exploit?
2. Scope Metric – Does the blast radius stay contained?
3. Impact Metrics – What does the attacker get if they succeed?
Reading the Vector String Step-by-Step
A CVSS vector uses key-value pairs separated by slashes (`/`). Here is how every metric slot works in practice, using the previous vector (`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N`) to show how each choice alters risk.
Group 1: Exploitability Metrics
Attack Vector – Where the attacker must be positioned:
N (Network)
A (Adjacent)
L (Local)
P (Physical)
Example: `AV:N` Network: Accessible anywhere over the internet. Highest risk level.
Attack Complexity – Conditions outside the attacker’s control required to succeed.
L (Low)
H (High)
Example: `AC:H` High: Requires special conditions (e.g., race conditions or specific network timing). Lowers total score.
Privileges Required – Level of access or accounts needed before attacking.
N (None)
L (Low)
H (High)
Example: `PR:N` None: An unauthenticated stranger can attempt the exploit.
User Interaction – Whether a victim must help trigger the attack.
N (None)
R (Required)
Example: `UI:N` | None: Zero-click. The target system executes the exploit automatically.
Group 2: Scope Metric
Scope – Does the vulnerability spill over to impact other components?
U (Unchanged)
C (Changed)
Example: `S:U` Unchanged: Damage stays within the vulnerable application/component.
Group 3: Impact Metrics (The CIA Triad)
Confidentiality – Impact on data privacy and secrecy:
N (None)
L (Low)
H (High)
Example: `C:H` High: Total data exposure (e.g., full database dump or leaked private keys).
Integrity – Impact on data accuracy and modification rights.
N (None)
L (Low)
H (High)
Example: `I:L` Low: Attacker can alter some files/data, but cannot take total control.
Availability – Impact on system uptime and performance.
N (None)
L (Low)
H (High)
Example: `A:N` None: System won’t crash or suffer Denial-of-Service (DoS).
The Mechanics of Score Calculation
CVSS scores do not use simple addition. They use a weighted mathematical formula where:
1. Impact drive the baseline: High damage across Confidentiality, Integrity, or Availability establishes the potential ceiling for the score.
2. Exploitability acts as a multiplier: High complexity (`AC:H`), required privileges (`PR:H`), or required user interaction (`UI:R`) act as dampers that lower the final numerical score.
Example Rule: In our vector, even though Confidentiality loss is High (`C:H`) and requires no authentication (`PR:N`), the fact that Attack Complexity is High (`AC:H`) keeps the final score capped at 6.5 (Medium) instead of pushing into 7.0–8.9 (High).
Severity Rating Reference Scale
| Score Range | Severity Rating | Typical Risk Profile |
| 0.0 | None | No security impact |
| 0.1-3.9 | Low | Minimal impact; requires rare conditions or high local access. |
| 4.0-6.9 | Medium | Significant impact, but constrained by high complexity or partial privileges. |
| 7.0-8.9 | High | Serious exploitability with high impact; easily usable by attackers. |
| 9.0-10.0 | Critical | “Wormable” or trivially exploitable flaw causing total system takeover. |